AAISM AI Risk Management Practice Test 4 — 15 Questions

Question 1

Which TWO factors help maintain 'AI Accountability'?

Accepted Answer

Clearly defined roles for model owners and stakeholders.. Accountability is maintained through clear roles/responsibilities and robust documentation of decision-making processes.

Answer

Hiring only external consultants for AI.

Answer

Automated, non-human review of all processes.

Answer

Removing all audit logs.

Question 2

In an AI supply chain, what is 'Dependency Confusion' risk?

Accepted Answer

When a build system pulls a malicious package instead of the intended private one.. Dependency confusion occurs when an attacker publishes a malicious package with the same name as an internal private package, hoping the package manager will pull the malicious public version.

Answer

When two models conflict in memory.

Answer

When the training data is ambiguous.

Answer

When a developer forgets to update a library.

Question 3

What is the primary goal of 'Model Monitoring' in the context of risk management?

Accepted Answer

To detect performance degradation, drift, and anomalous behavior.. Continuous monitoring detects anomalies, performance degradation, and drift, which are critical triggers for risk interventions.

Answer

To reduce the cost of GPU usage.

Answer

To block all internet traffic.

Answer

To update the marketing website automatically.

Question 4

What is the best way to manage 'Bias' in an AI system?

Accepted Answer

Perform regular audits and dataset balancing.. Regular auditing and dataset balancing are the most effective ways to identify and mitigate bias in AI systems.

Answer

Ignore the bias until a user complains.

Answer

Change the font on the website.

Answer

Delete all data that has bias.

Question 5

What is 'Model Stealing' as a risk?

Accepted Answer

When an attacker extracts the model's parameters/weights.. Model stealing is the attempt to gain unauthorized access to the underlying weights of a model, often through side-channel attacks or memory scraping.

Answer

When the model is used for a purpose other than intended.

Answer

When the training data is corrupted.

Answer

When a developer quits and takes the code.

Question 6

Which THREE steps are needed for 'AI Risk Assessment'?

Accepted Answer

Perform a threat modeling exercise.. Assessment requires identifying the AI components, evaluating threats, and determining the business impact.

Answer

Publish the risk assessment on the public internet.

Answer

Train a new model to verify the findings.

Question 7

Which of these is a 'Proactive' risk management strategy?

Accepted Answer

Adversarial testing and threat modeling.. Adversarial testing and threat modeling are proactive, as they identify risks before exploitation.

Answer

Shutting down the system after an attack.

Answer

Incident response to a breach.

Answer

Adding more security after a leak is discovered.

Question 8

Which THREE elements are essential for 'AI Governance'?

Accepted Answer

Defined AI ethics and safety policies.. AI governance requires clear policies, oversight committees, and defined risk frameworks.

Answer

Access to all employees' private emails.

Answer

A mandate to use the most expensive GPUs available.

Question 9

What is the primary risk of using 'Pre-trained models' from public hubs without verification?

Accepted Answer

The model may contain backdoors or malicious code.. Public hubs are susceptible to supply chain attacks where models may contain backdoors or malicious weights.

Answer

The model will not support Python.

Answer

The model will be too small.

Answer

The model will not have a web interface.

Question 10

What is 'Model Drift'?

Accepted Answer

Performance decay due to changing data distributions.. Model drift refers to the degradation of model performance over time because the real-world data distribution changes and no longer matches the training data.

Answer

The model code being rewritten.

Answer

The model being moved to a different cloud region.

Answer

The model file becoming corrupted.

Question 11

Which THREE technical controls effectively manage 'Third-Party AI Vendor' risks?

Accepted Answer

Independent verification of the vendor's model performance.. Managing third-party AI risk involves technical validation, contractual oversight, and ongoing monitoring.

Answer

Asking the vendor to delete all their internal logs.

Answer

Requiring all employees to use the vendor's internal Wi-Fi.

Question 12

What is 'AI Red Teaming'?

Accepted Answer

Proactive adversarial testing to identify model weaknesses.. AI Red Teaming is a structured process of testing an AI system's safety and security by attempting to find vulnerabilities through adversarial attacks.

Answer

The marketing department's review of AI ads.

Answer

An automated script that changes the model color.

Answer

The process of painting red marks on the server racks.

Question 13

Which TWO items must be documented in an 'AI Model Card'?

Accepted Answer

Known limitations and failure modes.. Model Cards are meant to document intended use and limitations to ensure transparency.

Answer

The color scheme of the model's website.

Answer

The social security numbers of all developers.

Answer

The hardware purchase receipts.

Question 14

What is the primary risk of 'Over-reliance' on AI outputs?

Accepted Answer

Users may accept incorrect or harmful AI-generated information.. Over-reliance (automation bias) leads to users trusting AI outputs without verification, which can be disastrous if the model makes errors or hallucinates.

Answer

The model will perform too well.

Answer

The server will overheat.

Answer

The model runs out of memory.

Question 15

Which risk management activity happens during the 'Design' phase of an AI project?

Accepted Answer

Threat modeling and initial risk assessment.. Threat modeling and identifying ethical/privacy requirements should occur at the design stage before development begins.

Answer

User manual writing.

Answer

Hardware installation.

Answer

Full-scale production deployment.